Fabric Site

Location in GUI: Provision » SD-Access » Fabric Sites

Diagram

Diagram

Diagram

Classes

catalyst_center

Name	Type	Constraint	Mandatory	Default Value
fabric	Class	fabric	No

fabric (catalyst_center)

Name	Type	Constraint	Mandatory	Default Value
fabric_sites	List	fabric_sites	No

fabric_sites (catalyst_center.fabric)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
fabric_devices	List	fabric_devices	No
authentication_template_name	Choice	No Authentication, Open Authentication, Closed Authentication, Low Impact	No
authentication_template	Class	authentication_template	No
pub_sub_enabled	Boolean	true, false	No	false
reconfigure	Boolean	true, false	No
l3_virtual_networks	List	String[min: 1]	No
l2_virtual_networks	List	l2_virtual_networks	No
anycast_gateways	List	anycast_gateways	No
wireless_ssids	List	wireless_ssids	No
fabric_zones	List	fabric_zones	No
multicast	Class	multicast	No

fabric_sites (catalyst_center.fabric)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
authentication_template	Class	authentication_template	No
pub_sub_enabled	Boolean	true, false	No	false
reconfigure	Boolean	true, false	No
l3_virtual_networks	List	String	No
l2_virtual_networks	List	l2_virtual_networks	No
anycast_gateways	List	anycast_gateways	No
wireless_ssids	List	wireless_ssids	No
fabric_zones	List	fabric_zones	No
multicast	Class	multicast	No

fabric_devices (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String	min: 1, matches: .*\S.*	Yes
fabric_roles	List	Choice[BORDER_NODE, CONTROL_PLANE_NODE, EDGE_NODE, WIRELESS_CONTROLLER_NODE, EMBEDDED_WIRELESS_CONTROLLER_NODE, EXTENDED_NODE]	No
border_types	List	Choice[LAYER_2, LAYER_3]	No
sda_transit	String		No
affinity_id_prime	Integer	min: 0, max: 2147483647	No
affinity_id_decider	Integer	min: 0, max: 2147483647	No
connected_to_internet	Boolean	true, false	No
multicast_over_transit	Boolean	true, false	No
import_external_routes	Boolean	true, false	No
default_exit	Boolean	true, false	No
border_priority	Integer	min: 1, max: 9	No
prepend_autonomous_system_count	Integer	min: 1, max: 10	No
local_autonomous_system_number	Integer	min: 1, max: 4294967295	No
external_domain_routing_protocol_name	Choice	BGP	No
external_handoff_pool	String		No
l2_handoffs	Class	l2_handoffs	No
l3_handoffs	List	l3_handoffs	No
port_assignments	Class	port_assignments	No

authentication_template (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	Choice	Open Authentication, Closed Authentication, Low Impact	Yes	No Authentication
dot1x_to_mab_fallback_timeout	Integer	min: 3, max: 120	No
wake_on_lan	Boolean	true, false	No
number_of_hosts	Choice	Unlimited, Single	No
bpdu_guard	Boolean	true, false	No
authentication_order	Choice	mac, dot1x	No
pre_auth_acl	Class	pre_auth_acl	No

authentication_template (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes	No Authentication
dot1x_to_mab_fallback_timeout	Integer	min: 3, max: 120	No
wake_on_lan	Boolean	true, false	No
number_of_hosts	Choice	Unlimited, Single	No
bpdu_guard	Boolean	true, false	No
authentication_order	Choice	mac, dot1x	No
pre_auth_acl	Class	pre_auth_acl	No

l2_virtual_networks (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
vlan_name	String		No
vlan_id	Integer	min: 2, max: 4093	No
traffic_type	Choice	DATA, VOICE	No
fabric_enabled_wireless	Boolean	true, false	No
wireless_flooding_enabled	Boolean	true, false	No
associated_l3_virtual_network_name	String		No

l2_virtual_networks (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
vlan_name	String		No
vlan_id	Integer	min: 2, max: 4093	No
traffic_type	Choice	DATA, VOICE	No
fabric_enabled_wireless	Boolean	true, false	No
associated_l3_virtual_network_name	String		No

anycast_gateways (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
ip_pool_name	String	min: 1, matches: .*\S.*	Yes
pool_type	Any	Choice[EXTENDED_NODE, FABRIC_AP] or Null	No
auto_generate_vlan_name	Boolean	true, false	No	false
vlan_name	String		No
vlan_id	Integer	min: 2, max: 4093	No
security_group_name	String		No
ip_directed_broadcast	Boolean	true, false	No	false
intra_subnet_routing_enabled	Boolean	true, false	No	false
multiple_ip_to_mac_addresses	Boolean	true, false	No	false
supplicant_based_extended_node_onboarding	Boolean	true, false	No
group_based_policy_enforcement_enabled	Boolean	true, false	No
layer2_flooding	Boolean	true, false	No	false
wireless_flooding_enabled	Boolean	true, false	No
traffic_type	Choice	DATA, VOICE	No	DATA
critical_pool	Boolean	true, false	No	false
wireless_pool	Boolean	true, false	No	false
tcp_mss_adjustment	Integer	min: 500, max: 1440	No
l3_virtual_network	String		No
additional_ip_pools	List	additional_ip_pools	No

anycast_gateways (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
ip_pool_name	String		Yes
additional_ip_pools	List	String	No
pool_type	Any	Choice[EXTENDED_NODE, FABRIC_AP] or Null	No
auto_generate_vlan_name	Boolean	true, false	No	false
vlan_name	String		No
vlan_id	Integer	min: 2, max: 4093	No
security_group_name	String		No
ip_directed_broadcast	Boolean	true, false	No	false
intra_subnet_routing_enabled	Boolean	true, false	No	false
multiple_ip_to_mac_addresses	Boolean	true, false	No	false
supplicant_based_extended_node_onboarding	Boolean	true, false	No
group_based_policy_enforcement_enabled	Boolean	true, false	No
layer2_flooding	Boolean	true, false	No	false
wireless_flooding_enabled	Boolean	true, false	No
traffic_type	Choice	DATA, VOICE	No	DATA
critical_pool	Boolean	true, false	No	false
wireless_pool	Boolean	true, false	No	false
tcp_mss_adjustment	Integer	min: 500, max: 1440	No
l3_virtual_network	String		No

anycast_gateways (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
ip_pool_name	String		Yes
additional_ip_pools	List	String	No
pool_type	Any	Choice[EXTENDED_NODE, FABRIC_AP] or Null	No
auto_generate_vlan_name	Boolean	true, false	No	false
vlan_name	String		No
vlan_id	Integer	min: 2, max: 4093	No
security_group_name	String		No
ip_directed_broadcast	Boolean	true, false	No	false
intra_subnet_routing_enabled	Boolean	true, false	No	false
multiple_ip_to_mac_addresses	Boolean	true, false	No	false
supplicant_based_extended_node_onboarding	Boolean	true, false	No
group_based_policy_enforcement_enabled	Boolean	true, false	No
layer2_flooding	Boolean	true, false	No	false
traffic_type	Choice	DATA, VOICE	No	DATA
critical_pool	Boolean	true, false	No	false
wireless_pool	Boolean	true, false	No	false
tcp_mss_adjustment	Integer	min: 500, max: 1440	No
l3_virtual_network	String		No

wireless_ssids (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
vlan_name	String		Yes
security_group_name	String		No

wireless_ssids (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
vlan_name	String		Yes

fabric_zones (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
authentication_template_name	Choice	No Authentication, Open Authentication, Closed Authentication, Low Impact	No
l3_virtual_networks	List	String	No
l2_virtual_networks	List	String	No
anycast_gateways	List	String	No

fabric_zones (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
authentication_template	Class	authentication_template	No
l3_virtual_networks	List	String	No
anycast_gateways	List	String	No
l2_virtual_networks	List	String	No

multicast (catalyst_center.fabric.fabric_sites)

Name	Type	Constraint	Mandatory	Default Value
replication_mode	Choice	NATIVE_MULTICAST, HEADEND_REPLICATION	No
wireless_multicast_enabled	Boolean	true, false	No
virtual_networks	List	virtual_networks	No

l2_handoffs (catalyst_center.fabric.fabric_sites.fabric_devices)

Name	Type	Constraint	Mandatory	Default Value
l2_without_anycast_gateway	Class	l2_without_anycast_gateway	No
l2_with_anycast_gateway	List	l2_with_anycast_gateway	No

l3_handoffs (catalyst_center.fabric.fabric_sites.fabric_devices)

Name	Type	Constraint	Mandatory	Default Value
ip_transit_name	String		Yes
interfaces	List	interfaces	Yes

port_assignments (catalyst_center.fabric.fabric_sites.fabric_devices)

Name	Type	Constraint	Mandatory	Default Value
interfaces	List	interfaces	No
port_channels	List	port_channels	No

pre_auth_acl (catalyst_center.fabric.fabric_sites.authentication_template)

Name	Type	Constraint	Mandatory	Default Value
enabled	Boolean	true, false	No
implicit_action	Choice	DENY, PERMIT	No
description	String		No
access_contracts	List	access_contracts	No

additional_ip_pools (catalyst_center.fabric.fabric_sites.anycast_gateways)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
order	Integer	min: 2, max: 5	Yes

virtual_networks (catalyst_center.fabric.fabric_sites.multicast)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
ip_pool_name	String		Yes
ipv4_ssm_ranges	List	String	No
multicast_rps	List	multicast_rps	No

l2_without_anycast_gateway (catalyst_center.fabric.fabric_sites.fabric_devices.l2_handoffs)

Name	Type	Constraint	Mandatory	Default Value
vlans	List	vlans	No
interfaces	List	String	No

l2_with_anycast_gateway (catalyst_center.fabric.fabric_sites.fabric_devices.l2_handoffs)

Name	Type	Constraint	Mandatory	Default Value
l3_virtual_network	String		Yes
ip_pool_name	String		Yes
external_vlan	Integer	min: 2, max: 4094	No
interfaces	List	String	No

interfaces (catalyst_center.fabric.fabric_sites.fabric_devices.l3_handoffs)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
virtual_networks	List	virtual_networks	Yes

interfaces (catalyst_center.fabric.fabric_sites.fabric_devices.port_assignments)

Name	Type	Constraint	Mandatory	Default Value
interface_name	String		No
interfaces_range	String	Regex: ^[A-Za-z]+\d+(/\d+)+-\d+(/\d+)+$	No
interface_description	String		No
connected_device_type	Choice	USER_DEVICE, ACCESS_POINT, TRUNKING_DEVICE, AUTHENTICATOR_SWITCH, SUPPLICANT_BASED_EXTENDED_NODE	Yes
data_vlan_name	String		No
voice_vlan_name	String		No
security_group_name	String		No
authenticate_template_name	Choice	No Authentication, Open Authentication, Closed Authentication, Low Impact	No

port_channels (catalyst_center.fabric.fabric_sites.fabric_devices.port_assignments)

Name	Type	Constraint	Mandatory	Default Value
id	Integer		Yes
connected_device_type	Choice	TRUNK, EXTENDED_NODE	Yes
protocol	Choice	ON, LACP, PAGP	No
description	String		No
interface_names	List	String	Yes
native_vlan_id	Integer	min: 1, max: 4094	No
allowed_vlan_ranges	String		No

access_contracts (catalyst_center.fabric.fabric_sites.authentication_template.pre_auth_acl)

Name	Type	Constraint	Mandatory	Default Value
action	Choice	PERMIT, DENY	Yes
port	Choice	domain, bootpc, bootps	Yes
protocol	Choice	TCP, UDP, TCP_UDP	Yes

multicast_rps (catalyst_center.fabric.fabric_sites.multicast.virtual_networks)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
rp_location	Choice	FABRIC, EXTERNAL	Yes
ipv4_address	IP		No
ipv6_address	IP		No
is_default_v4_rp	Boolean	true, false	No
is_default_v6_rp	Boolean	true, false	No
fabric_rps	List	String	No
ipv4_asm_ranges	List	String	No
ipv6_asm_ranges	List	String	No

vlans (catalyst_center.fabric.fabric_sites.fabric_devices.l2_handoffs.l2_without_anycast_gateway)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
external_vlan	Integer	min: 2, max: 4094	No

virtual_networks (catalyst_center.fabric.fabric_sites.fabric_devices.l3_handoffs.interfaces)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
local_ip_address	IP		No
peer_ip_address	IP		No
peer_ipv6_address	IP		No
local_ipv6_address	IP		No
tcp_mss_adjustment	Integer	min: 500, max: 1440	No
vlan	Integer	min: 2, max: 4093	Yes

Fabric Sites define the SD-Access fabric boundary within the site hierarchy. Enabling a site as a fabric site activates Software-Defined Access functionality including micro-segmentation, policy enforcement, and automated underlay/overlay provisioning. Fabric sites contain Border Devices, Virtual Networks, Anycast Gateways, and Port Assignments. This resource is SDA fabric only.

Examples

Example-1: Basic Fabric Site with No Authentication

This example demonstrates how to configure a basic SD-Access fabric site in Catalyst Center with no authentication requirements. Fabric sites enable Software-Defined Access functionality within designated network areas, providing centralized policy enforcement and micro-segmentation capabilities.

The fabric site configuration includes:

• Site hierarchy specification (Global/Canada) for geographic and organizational structure
• Authentication template assignment (No Authentication) for simplified initial deployment
• Foundation for SD-Access fabric enablement without immediate authentication requirements
• Base configuration suitable for proof-of-concept or laboratory environments

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Canada
        authentication_template_name: No Authentication
        pub_sub_enabled: true

Example-2: Campus Fabric Site with Closed Authentication

This example demonstrates how to configure a campus fabric site with closed authentication mode for high-security environments where all network access requires explicit authentication and authorization.

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Canada
        authentication_template_name: Closed Authentication
        pub_sub_enabled: true

Note: A fabric site that uses Closed Authentication, Open Authentication or Low Impact needs an ISE server configured for its site hierarchy (see AAA Servers). Otherwise Catalyst Center rejects the fabric site with NCHS20424 (“Please configure an ISE server for the network hierarchy before enabling an authentication profile”).

Example-3: Multi-Site Fabric Deployment

This example shows how to configure multiple fabric sites across different geographic locations, each with appropriate authentication templates based on local security requirements and organizational policies.

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/North_America/New_York_Office
        authentication_template_name: Closed Authentication
        pub_sub_enabled: true
      - name: Global/Asia_Pacific/Tokyo_Branch
        authentication_template_name: Open Authentication
        pub_sub_enabled: true
      - name: Global/Europe/London_Office
        authentication_template_name: Low Impact
        pub_sub_enabled: true
      - name: Global/Americas/Mexico_City_Branch
        authentication_template_name: No Authentication
        pub_sub_enabled: true

Example-4: Fabric Site with a Custom Authentication Template

This example demonstrates how to configure a fabric site with custom options for authentication templates

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Corporate/London_Office
        authentication_template:
          name: Closed Authentication
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: dot1x
          bpdu_guard: false
        pub_sub_enabled: true


      - name: Global/Corporate/Tokyo_Branch
        authentication_template:
          name: Low Impact
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: mac
          bpdu_guard: false
          pre_auth_acl:
            enabled: true
            implicit_action: PERMIT
            access_contracts:
              - action: PERMIT
                port: domain
                protocol: UDP
              - action: PERMIT
                port: bootpc
                protocol: UDP
              - action: PERMIT
                port: bootps
                protocol: UDP
        pub_sub_enabled: true

Example-5: Fabric Site Reconfiguration

When the IPv4 pool used by a Fabric site is modified, for example when DHCP or DNS server information is updated, the Fabric becomes out of date. The site must be re-provisioned so that the changes take effect.

Cisco Catalyst Center displays a warning on the Fabric site indicating that a reconfiguration is required.

Caution

You modified the IP pools used by this Fabric. The Fabric is now out of date. To update, select Reconfigure Fabric. The update time depends on the number of devices. To trigger the reconfiguration through the Data Model, add the field “reconfigure: true” under the Fabric site configuration.

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Poland/Krakow
        reconfigure: true

Example-6: Fabric Site Configuration with Fabric Zones

This example demonstrates how to configure a fabric site that has a fabric zone

Note

This is a greenfield deployment: the Fabric Site and its Fabric Zone are created together in a single configuration. For converting an existing (brownfield) Fabric Site into a Fabric Zone, refer to Example-7.

Caution

In the devices yaml file, the Edge device that will be part of the fabric zone, is configured with a fabric_zone element matching the fabric zone name

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Poland/Krakow
        authentication_template:
          name: Closed Authentication
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: dot1x
        pub_sub_enabled: false
        l2_virtual_networks:
          - name: L2_SDA_VN_1
            vlan_name: L2_VLAN_USERS
            vlan_id: 455
            traffic_type: DATA
            fabric_enabled_wireless: false
          - name: L2_VN
            vlan_name: L2VN_VLAN
            traffic_type: DATA
            fabric_enabled_wireless: false
        l3_virtual_networks:
          - SDA_VN_USERS
          - SDA_VN_PRINTERS
          - SDA_VN_CORPORATE
          - INFRA_VN
        anycast_gateways:
          - ip_pool_name: Campus
            vlan_name: Campus_VLAN
            traffic_type: DATA
            l3_virtual_network: SDA_VN_USERS
            wireless_pool: true
          - ip_pool_name: Voice
            vlan_name: Voice_VLAN
            vlan_id: 224
            traffic_type: VOICE
            l3_virtual_network: SDA_VN_USERS
          - ip_pool_name: AP
            pool_type: FABRIC_AP
            vlan_name: AP_VLAN
            vlan_id: 225
            traffic_type: DATA
            l3_virtual_network: INFRA_VN
        fabric_zones:
          - name: Global/Poland/Krakow/Bld_B
            authentication_template_name: No Authentication
            l3_virtual_networks:
              - SDA_VN_USERS
            l2_virtual_networks:
              - L2_SDA_VN_1
            anycast_gateways:
              - Campus
      - name: Global/Poland/Krakow/Bld_B
        fabric_devices:
          - name: LAN-EN2
            fabric_roles:
              - EDGE_NODE
  inventory:
    devices:
      - name: LAN-EN2
        fqdn_name: LAN-EN2.cisco.eu
        device_ip: 181.1.1.43
        pid: C9KV-UADP-8P
        state: PROVISION
        device_role: ACCESS
        site: Global/Poland/Krakow/Bld_B

Example-7: Brownfield Fabric Zone Conversion

Catalyst Center supports two ways to create a Fabric Zone through the GUI:

1. Greenfield: Create the Fabric Zone during the creation of the Fabric Site.
2. Brownfield: Convert an existing Fabric Site (or move devices from an existing Fabric Site) into a Fabric Zone.

Caution

The Network as Code framework only supports seamless Fabric Zone creation for greenfield deployments (Option 1 above). A brownfield Fabric Zone conversion on a day-2 operation is a disruptive operation and must be properly planned within a maintenance window.

Why is this disruptive?

The brownfield conversion requires swapping the device’s fabric membership from a Fabric Site ID to a Fabric Zone ID (i.e. replacing the fabric_site reference with a fabric_zone reference on the device). To perform this swap safely, the existing fabric_roles must first be removed from the affected devices. Removing fabric roles also affects any associated port-assignments and port-channels on those devices, which will interrupt traffic on those interfaces until the devices are re-provisioned into the Fabric Zone.

This procedure also requires several sequential Terraform applies to complete safely, since each device must be fully removed from its current fabric role (Fabric Site ID) before being re-associated with the target Fabric Zone ID.

Steps to perform a brownfield Fabric Zone conversion:

1. Plan a maintenance window. Notify stakeholders since traffic on the affected devices’ port-assignments and port-channels will be disrupted.
2. Remove the existing fabric_roles and fabric_site from ALL devices that will become part of the location associated with the day-N Fabric Zone (commenting out or deleting these fields in the inventory data model), then run terraform apply.
3. Create the Fabric Zone under the parent Fabric Site and swap the device’s fabric_site reference for a fabric_zone reference in the inventory data model, pointing it to the target Fabric Zone name, then run terraform apply to re-provision the devices into the Fabric Zone with the desired fabric_roles.
4. Re-apply any port-assignments and port-channels that were affected by the removal of the fabric roles.
5. Validate that the devices are correctly provisioned in the target Fabric Zone and that all port-assignments and port-channels are restored and operational.

Example-8: Global Authentication Templates

fabric.authentication_templates customizes the global (COMMON) authentication templates that fabric sites and zones start from. Only Closed Authentication, Open Authentication and Low Impact can be customized. A fabric site that needs different settings can still override them with its own authentication_template (Example-4).

catalyst_center:
  fabric:
    authentication_templates:
      - name: Closed Authentication
        dot1x_to_mab_fallback_timeout: 28
        number_of_hosts: Single
        authentication_order: dot1x
        bpdu_guard: false
      - name: Low Impact
        dot1x_to_mab_fallback_timeout: 22
        pre_auth_acl:
          enabled: true
          implicit_action: DENY
          access_contracts:
            - action: PERMIT
              port: bootps
              protocol: UDP
            - action: PERMIT
              port: bootpc
              protocol: UDP
            - action: PERMIT
              port: domain
              protocol: UDP

Note: Removing an entry from authentication_templates does not revert the global template in Catalyst Center; it keeps the last values that were applied. To go back to the previous settings, set them explicitly before removing the entry.

Note: Supplicant-based extended node onboarding (an EXTENDED_NODE anycast gateway with supplicant_based_extended_node_onboarding: true) needs the global Closed Authentication template with authentication_order: dot1x and bpdu_guard: false; otherwise Catalyst Center rejects it (NCSO30009, NCSO30015). See Anycast Gateway.

Changing Fabric Device Roles

Changing fabric_roles of an existing fabric device, or its border settings local_autonomous_system_number, default_exit or import_external_routes, is not a simple in-place update:

• With the bulk API (use_bulk_api = true), the fabric device is deleted and added again. Catalyst Center removes the device’s L2 and L3 handoffs and port assignments together with it. If adding it back fails, the apply can still finish without an error, so check the next plan for missing fabric devices and handoffs.
• Without the bulk API, role changes are ignored only while the device remains in the same resource and its device_roles attribute is covered by ignore_changes. Changes that move the device between role-specific resources cause removal and recreation. For example, adding BORDER_NODE to an edge-only or control-plane-only device moves it to border_device. Review the Terraform plan and allow for disruption to fabric membership and dependent configuration. A change of local_autonomous_system_number or import_external_routes on an existing border can fail at apply with NCHS20123 (“Update not allowed for field”).

Plan such a change inside a maintenance window, and expect the device’s handoffs and port assignments to be removed and created again.

Note: A fabric site with a fabric wireless controller supports at most two control plane nodes. Catalyst Center rejects a third one with NCWL10805 (“Wireless Controller can support only a maximum of 2 Enterprise Map Servers per Fabric Domain”).

Fabric Sites define the SD-Access fabric boundary within the site hierarchy. Enabling a site as a fabric site activates Software-Defined Access functionality including micro-segmentation, policy enforcement, and automated underlay/overlay provisioning. Fabric sites contain Border Devices, Virtual Networks, Anycast Gateways, and Port Assignments. This resource is SDA fabric only.

Examples

Example-1: Basic Fabric Site with No Authentication

This example demonstrates how to configure a basic SD-Access fabric site in Catalyst Center with no authentication requirements. Fabric sites enable Software-Defined Access functionality within designated network areas, providing centralized policy enforcement and micro-segmentation capabilities.

The fabric site configuration includes:

• Site hierarchy specification (Global/Canada) for geographic and organizational structure
• Authentication template assignment (No Authentication) for simplified initial deployment
• Foundation for SD-Access fabric enablement without immediate authentication requirements
• Base configuration suitable for proof-of-concept or laboratory environments

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Canada
        authentication_template:
          name: No Authentication
        pub_sub_enabled: true

Example-2: Campus Fabric Site with Closed Authentication

This example demonstrates how to configure a campus fabric site with closed authentication mode for high-security environments where all network access requires explicit authentication and authorization.

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Canada
        authentication_template:
          name: Closed Authentication
        pub_sub_enabled: true

Example-3: Multi-Site Fabric Deployment

This example shows how to configure multiple fabric sites across different geographic locations, each with appropriate authentication templates based on local security requirements and organizational policies.

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/North_America/New_York_Office
        authentication_template:
          name: Closed Authentication
        pub_sub_enabled: true


      - name: Global/Asia_Pacific/Tokyo_Branch
        authentication_template:
          name: Open Authentication
        pub_sub_enabled: true

      - name: Global/Europe/London_Office
        authentication_template:
          name: Low Impact
        pub_sub_enabled: true


      - name: Global/Americas/Mexico_City_Branch
        authentication_template:
          name: No Authentication
        pub_sub_enabled: true

Example-4: Fabric Site with a Custom Authentication Template

This example demonstrates how to configure a fabric site with custom options for authentication templates

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Corporate/London_Office
        authentication_template:
          name: Closed Authentication
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: dot1x
          bpdu_guard: false
        pub_sub_enabled: true


     - name: Global/Corporate/Tokyo_Branch
        authentication_template:
        authentication_template:
          name: Low Impact
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: mac
          bpdu_guard: false
          pre_auth_acl:
            enabled: true
            implicit_action: PERMIT
            access_contracts:
              - action: PERMIT
                port: domain
                protocol: UDP
              - action: PERMIT
                port: bootpc
                protocol: UDP
              - action: PERMIT
                port: bootps
                protocol: UDP
        pub_sub_enabled: true

Example-5: Fabric Site Reconfiguration

When the IPv4 pool used by a Fabric site is modified, for example when DHCP or DNS server information is updated, the Fabric becomes out of date. The site must be re-provisioned so that the changes take effect.

Cisco Catalyst Center displays a warning on the Fabric site indicating that a reconfiguration is required.

Caution

You modified the IP pools used by this Fabric. The Fabric is now out of date. To update, select Reconfigure Fabric. The update time depends on the number of devices. To trigger the reconfiguration through the Data Model, add the field “reconfigure: true” under the Fabric site configuration.

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Poland/Krakow
        reconfigure: true

Example-6: Fabric Site Configuration with Fabric Zones

This example demonstrates how to configure a fabric site that has a fabric zone

Note

This is a greenfield deployment: the Fabric Site and its Fabric Zone are created together in a single configuration. For converting an existing (brownfield) Fabric Site into a Fabric Zone, refer to Example-7.

Caution

In the devices yaml file, the Edge device that will be part of the fabric zone, is configured with a fabric_zone element matching the fabric zone name

---
catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Poland/Bytom
        authentication_template:
          name: Closed Authentication
          dot1x_to_mab_fallback_timeout: 30
          wake_on_lan: false
          number_of_hosts: Unlimited
          authentication_order: dot1x
        pub_sub_enabled: false
        l2_virtual_networks:
          - name: L2_SDA_VN_1
            vlan_name: L2_VLAN_USERS
            vlan_id: 455
            traffic_type: DATA
            fabric_enabled_wireless: false
          - name: L2_VN
            vlan_name: L2VN_VLAN
            traffic_type: DATA
            fabric_enabled_wireless: false
        l3_virtual_networks:
          - SDA_VN_USERS
          - SDA_VN_PRINTERS
          - SDA_VN_CORPORATE
          - INFRA_VN
        anycast_gateways:
          - ip_pool_name: Campus
            vlan_name: Campus_VLAN
            traffic_type: DATA
            l3_virtual_network: SDA_VN_USERS
            wireless_pool: true
          - ip_pool_name: Voice
            vlan_name: Voice_VLAN
            vlan_id: 224
            traffic_type: VOICE
            l3_virtual_network: SDA_VN_USERS
          - ip_pool_name: AP
            pool_type: FABRIC_AP
            vlan_name: AP_VLAN
            vlan_id: 225
            traffic_type: DATA
            l3_virtual_network: INFRA_VN

        fabric_zones:
          - name: Global/Poland/Bytom/Bld_B
            authentication_template:
              name: No Authentication
            l3_virtual_networks:
              - SDA_VN_USERS
            l2_virtual_networks:
              - L2_SDA_VN_1
            anycast_gateways:
              - Campus


  inventory:
    devices:
      - name: LAN-EN2
        fqdn_name: LAN-EN2.cisco.eu
        device_ip: 181.1.1.43
        pid: C9KV-UADP-8P
        state: PROVISION
        device_role: ACCESS
        site: Global/Poland/Bytom/Bld_B
        fabric_zone: Global/Poland/Bytom/Bld_B
        fabric_roles:
          - EDGE_NODE

Example-7: Brownfield Fabric Zone Conversion

Catalyst Center supports two ways to create a Fabric Zone through the GUI:

1. Greenfield: Create the Fabric Zone during the creation of the Fabric Site.
2. Brownfield: Convert an existing Fabric Site (or move devices from an existing Fabric Site) into a Fabric Zone.

Caution

The Network as Code framework only supports seamless Fabric Zone creation for greenfield deployments (Option 1 above). A brownfield Fabric Zone conversion on a day-2 operation is a disruptive operation and must be properly planned within a maintenance window.

Why is this disruptive?

The brownfield conversion requires swapping the device’s fabric membership from a Fabric Site ID to a Fabric Zone ID (i.e. replacing the fabric_site reference with a fabric_zone reference on the device). To perform this swap safely, the existing fabric_roles must first be removed from the affected devices. Removing fabric roles also affects any associated port-assignments and port-channels on those devices, which will interrupt traffic on those interfaces until the devices are re-provisioned into the Fabric Zone.

This procedure also requires several sequential Terraform applies to complete safely, since each device must be fully removed from its current fabric role (Fabric Site ID) before being re-associated with the target Fabric Zone ID.

Steps to perform a brownfield Fabric Zone conversion:

1. Plan a maintenance window. Notify stakeholders since traffic on the affected devices’ port-assignments and port-channels will be disrupted.
2. Remove the existing fabric_roles and fabric_site from ALL devices that will become part of the location associated with the day-N Fabric Zone (commenting out or deleting these fields in the inventory data model), then run terraform apply.
3. Create the Fabric Zone under the parent Fabric Site and swap the device’s fabric_site reference for a fabric_zone reference in the inventory data model, pointing it to the target Fabric Zone name, then run terraform apply to re-provision the devices into the Fabric Zone with the desired fabric_roles.
4. Re-apply any port-assignments and port-channels that were affected by the removal of the fabric roles.
5. Validate that the devices are correctly provisioned in the target Fabric Zone and that all port-assignments and port-channels are restored and operational.